openBaraza HCM 3.1.6 does not properly neutralize user-controllable input: an unauthenticated remote attacker can conduct a stored cross-site scripting (XSS) attack against an administrative user from hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view=).
CWE-79
CVE-2021-3862
icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
CVE-2021-3863
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
CVE-2021-38559
DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter.
CVE-2021-38560
Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls, such as in RelocateAttachments.aspx.
CVE-2021-3857
chaskiq is vulnerable to Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)